<html>
<head><meta charset="utf-8"><title>raw ref semantics · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html">raw ref semantics</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="232188413"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232188413" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232188413">(Mar 28 2021 at 19:45)</a>:</h4>
<p>I see there are new docs on the raw ref macros: <a href="https://doc.rust-lang.org/beta/std/mem/union.MaybeUninit.html#initializing-a-struct-field-by-field">https://doc.rust-lang.org/beta/std/mem/union.MaybeUninit.html#initializing-a-struct-field-by-field</a></p>
<p>Is this really safe? I assumed that the subexpression <code>(*ptr)</code> is instant UB if the data behind ptr is uninitialized.<br>
Miri even says  that my assumption is correct in isolation: <a href="https://play.rust-lang.org/?gist=d211dc58740ce93d458f4f0527eab6a3">https://play.rust-lang.org/?gist=d211dc58740ce93d458f4f0527eab6a3</a></p>
<p>So is there some magic here because of the raw ref around it? I assumed that <code>&amp;raw (*ptr).list</code> is equivalent to:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="kd">let</span><span class="w"> </span><span class="n">a</span>: <span class="kp">&amp;</span><span class="nc">Foo</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">*</span><span class="n">ptr</span><span class="p">;</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">raw_ref</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="n">raw</span><span class="w"> </span><span class="n">a</span><span class="p">.</span><span class="n">list</span><span class="p">;</span><span class="w"></span>
</code></pre></div>
<p>Now if there is some magic here, it definitely solves a lot of problems (initializing by field, getting a pointer to a field without going through an intermediate reference(from a pointer to a struct), and for <code>offset_of!</code> macros).<br>
but A. I find it confusing. B. If it's fine then the deref there shouldn't require an unsafe block.</p>



<a name="232190161"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232190161" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232190161">(Mar 28 2021 at 20:15)</a>:</h4>
<p>I assume you mean</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="kd">let</span><span class="w"> </span><span class="n">a</span>: <span class="kp">&amp;</span><span class="nc">Foo</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="p">(</span><span class="o">*</span><span class="n">ptr</span><span class="p">);</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">raw_ref</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="n">raw</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="n">a</span><span class="p">).</span><span class="n">list</span><span class="p">;</span><span class="w"></span>
</code></pre></div>
<p>? (Assuming that <code>ptr: *const Foo</code>.)</p>



<a name="232190264"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232190264" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232190264">(Mar 28 2021 at 20:16)</a>:</h4>
<p>Even so, this is not true; the whole point of raw-ref syntax is that we don't create any temporary references to subpaths in the place expression</p>



<a name="232190377"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232190377" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232190377">(Mar 28 2021 at 20:18)</a>:</h4>
<p>The "magic" is that the whole expression <code>&amp;raw (*a).list</code> is a single operation; MIR (and LLVM!) directly has an instruction for getting a subpart of a data structure given by a number of dereferences and array accesses</p>



<a name="232198864"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232198864" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232198864">(Mar 28 2021 at 22:50)</a>:</h4>
<p>So it's a single expression, ha.<br>
is nesting derefs there also single expression? (e.g. <code>&amp;raw (*(*ptr).field).inner</code>)</p>
<p>and shouldn't this operation be safe?</p>



<a name="232199643"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232199643" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232199643">(Mar 28 2021 at 23:04)</a>:</h4>
<p>It is a single expression (IIRC), but the computation would still need to read memory at <code>(*ptr).field</code> in order to construct the place, so I think that is not safe</p>



<a name="232199734"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232199734" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232199734">(Mar 28 2021 at 23:06)</a>:</h4>
<p>although it's possible that <code>let _ = (*(*ptr).field).inner;</code> would be safe</p>



<a name="232237782"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232237782" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232237782">(Mar 29 2021 at 09:06)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232199643">said</a>:</p>
<blockquote>
<p>It is a single expression (IIRC), but the computation would still need to read memory at <code>(*ptr).field</code> in order to construct the place, so I think that is not safe</p>
</blockquote>
<p>that means that <code>&amp;raw const (*ptr::null::&lt;A&gt;()).field</code> isn't valid?<br>
also, if there's an actual read then the field by field initialization isn't safe?</p>



<a name="232239465"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232239465" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232239465">(Mar 29 2021 at 09:22)</a>:</h4>
<p>No, that's fine, it's only when you have 2+ layers of dereferencing that you have a problem, essentially because <code>*p</code> is an operation that turns a value into a place, so you need to insert a <code>place2value</code> in <code>&amp;raw **p</code>, to convert the place <code>*p</code> into a value, so that <code>**p</code> can be a place whose address is taken with <code>&amp;raw **p</code>. The <code>place2value(*p)</code> needs to actually read memory at the location <code>p</code>, so it can fail, but even if <code>*p</code> is null <code>&amp;raw **p</code> would make sense.</p>



<a name="232240105"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232240105" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232240105">(Mar 29 2021 at 09:28)</a>:</h4>
<p>An alternative notation would take as primitives the operations <code>p.field() := &amp;raw (*p).field</code> (offsetting a pointer to a subfield, always safe) and <code>p.deref() := place2value(*p)</code> (read memory at a pointer location, can cause UB), in which case <code>&amp;raw (*ptr).field</code> is <code>ptr.field()</code>, which is safe, while <code>let x = *(*ptr).field</code> is <code>let x = ptr.field().deref()</code> (not safe) and <code>&amp;raw (*(*ptr).field).inner</code> is <code>ptr.field().deref().inner()</code> (which is not safe because of the <code>deref</code>).</p>



<a name="232290965"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232290965" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232290965">(Mar 29 2021 at 15:54)</a>:</h4>
<p>damn this is confusing.</p>
<p>if this is the syntax we stay with then at least differentiating to safe/unsafe like you showed will help a lot in avoiding accidental UB here</p>



<a name="232561959"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232561959" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232561959">(Mar 31 2021 at 09:38)</a>:</h4>
<p><span class="user-mention" data-user-id="249222">@Elichai Turkel</span> <span class="user-mention" data-user-id="271719">@Mario Carneiro</span> </p>
<blockquote>
<p>No, that's fine,</p>
</blockquote>
<p>No it's not! See <a href="https://doc.rust-lang.org/reference/behavior-considered-undefined.html">https://doc.rust-lang.org/reference/behavior-considered-undefined.html</a> -- <code>*ptr</code> is UB when ptr dangles or is unaligned, even as part of <code>addr_of!((*ptr).field)</code>.</p>



<a name="232562053"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232562053" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232562053">(Mar 31 2021 at 09:38)</a>:</h4>
<p>These are the current rules, anyway. I <a href="#narrow/stream/213817-t-lang/topic/Alignment.20and.20raw.20pointer.20deref">hope we can change them</a> but it is not yet clear what we should change them to.</p>



<a name="232562132"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232562132" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232562132">(Mar 31 2021 at 09:39)</a>:</h4>
<p>However, it <em>is</em> okay to do these things when the data is <em>uninitialized</em> -- the initialization requirement only comes into play when constructing an actual value of the type, as in <code>let _val = *ptr;</code>.</p>



<a name="232562437"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232562437" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232562437">(Mar 31 2021 at 09:42)</a>:</h4>
<p>However your original equivalence certainly doesn't hold, <span class="user-mention" data-user-id="249222">@Elichai Turkel</span>. It's more like, <code>&amp;expr</code> is equivalent to</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="kd">let</span><span class="w"> </span><span class="n">ptr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">addr_of</span><span class="o">!</span><span class="p">(</span><span class="n">expr</span><span class="p">);</span><span class="w"></span>
<span class="o">&amp;*</span><span class="n">ptr</span><span class="w"> </span><span class="c1">// cast raw-ptr to reference</span>
</code></pre></div>



<a name="232562501"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232562501" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232562501">(Mar 31 2021 at 09:43)</a>:</h4>
<p>the second step, casting to a reference, introduces some extra restrictions, like <code>ptr</code> having to be aligned and pointing to valid (initialized) data</p>



<a name="232562522"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232562522" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232562522">(Mar 31 2021 at 09:43)</a>:</h4>
<p><code>addr_of!</code> is a way to get rid of those restrictions</p>



<a name="232562567"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232562567" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232562567">(Mar 31 2021 at 09:44)</a>:</h4>
<p>but at least so far, this has no effect on the rules for <code>*</code> (ptr deref)</p>



<a name="232573584"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232573584" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232573584">(Mar 31 2021 at 11:25)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232562567">said</a>:</p>
<blockquote>
<p>but at least so far, this has no effect on the rules for <code>*</code> (ptr deref)</p>
</blockquote>
<p>But it looks like it does?<br>
<code>let _v_field = &amp;raw (*ptr).list;</code> // this is valid even if <code>ptr</code> points at uninitialized values.<br>
<code>let _v = *ptr</code>  // this isn't valid as it reads from uninitialized memory.</p>
<p>so the expression <code>(*ptr)</code> has different effect if it's part of a <code>&amp;raw</code> expression and when it's not part of a raw expression</p>



<a name="232575404"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232575404" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232575404">(Mar 31 2021 at 11:41)</a>:</h4>
<p>That's a property of the read, not the dereference, though.</p>



<a name="232593650"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232593650" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232593650">(Mar 31 2021 at 13:46)</a>:</h4>
<p><span class="user-mention silent" data-user-id="257758">Connor Horman</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232575404">said</a>:</p>
<blockquote>
<p>That's a property of the read, not the dereference, though.</p>
</blockquote>
<p>I thought that a dereference means a read (except for the <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/261">weirdness</a> of <code>let _ = *ptr</code>)</p>



<a name="232597821"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232597821" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Connor Horman <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232597821">(Mar 31 2021 at 14:10)</a>:</h4>
<p>I don't know for rust specifically, but with my background in C and C++, to me, dereference means the actual indirection, IE. the <code>*ptr</code> in <code>let _v = *ptr;</code>. The read is the place-to-value conversion (or lvalue-to-rvalue conversion, in C++), but the dereference operation produces said place (however, <code>let _ = *ptr;</code> makes that definition wierd, as you said).</p>



<a name="232608602"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232608602" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232608602">(Mar 31 2021 at 15:13)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232561959">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="249222">Elichai Turkel</span> <span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> </p>
<blockquote>
<p>No, that's fine,</p>
</blockquote>
<p>No it's not! See <a href="https://doc.rust-lang.org/reference/behavior-considered-undefined.html">https://doc.rust-lang.org/reference/behavior-considered-undefined.html</a> -- <code>*ptr</code> is UB when ptr dangles or is unaligned, even as part of <code>addr_of!((*ptr).field)</code>.</p>
</blockquote>
<p>Wasn't this exactly the behavior we were talking about <a href="#narrow/stream/213817-t-lang/topic/Alignment.20and.20raw.20pointer.20deref/near/232154596">in the other thread</a>? Maybe it's undefined right now but I thought we were in agreement that this should be a safe operation, equivalent to (wrapping) <code>ptr + offset_of!(field)</code> on the underlying integers</p>



<a name="232608680"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232608680" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232608680">(Mar 31 2021 at 15:13)</a>:</h4>
<p>Otherwise it is impossible to work with packed structs</p>



<a name="232643866"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232643866" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232643866">(Mar 31 2021 at 18:44)</a>:</h4>
<p><span class="user-mention silent" data-user-id="257758">Connor Horman</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232575404">said</a>:</p>
<blockquote>
<p>That's a property of the read, not the dereference, though.</p>
</blockquote>
<p>exactly. Or rather, I'd say (as you also clarified later) it's a property of the place-to-value coercion (which involves reading the contents of the place and making it a value).<br>
this <em>constructs</em> a value, that hence has to satisfy the validity invariant of its type.</p>



<a name="232643914"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232643914" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232643914">(Mar 31 2021 at 18:44)</a>:</h4>
<p><span class="user-mention silent" data-user-id="249222">Elichai Turkel</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232593650">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="257758">Connor Horman</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232575404">said</a>:</p>
<blockquote>
<p>That's a property of the read, not the dereference, though.</p>
</blockquote>
<p>I thought that a dereference means a read (except for the <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/261">weirdness</a> of <code>let _ = *ptr</code>)</p>
</blockquote>
<p>no, in <code>&amp;*ptr</code>, a deref certainly does not read anything from memory</p>



<a name="232644250"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232644250" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232644250">(Mar 31 2021 at 18:47)</a>:</h4>
<blockquote>
<p>Maybe it's undefined right now but I thought we were in agreement that this should be a safe operation, equivalent to (wrapping) ptr + offset_of!(field) on the underlying integers</p>
</blockquote>
<p>So first of all, if it's UB right now then I wouldn't tell people that it's valid. ;)<br>
And secondly, I don't think we have that agreement. the main thrust is the other thread was that <code>addr_of!((*ptr).field)</code> should be equivalent to <code>add_no_overflow(ptr, field_offset)</code>, i.e., it would still be unsafe and cause UB in case of overflow.</p>



<a name="232644565"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232644565" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232644565">(Mar 31 2021 at 18:49)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232608680">said</a>:</p>
<blockquote>
<p>Otherwise it is impossible to work with packed structs</p>
</blockquote>
<p>I don't think that is true at all, though it depends on what exactly you mean. however, we could fix packed structs entirely by saying that <code>addr_of!((*ptr).field)</code> is equivalent to <code>ptr.offset_bytes(field_offset)</code>. This would still be unsafe.</p>



<a name="232644682"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232644682" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232644682">(Mar 31 2021 at 18:50)</a>:</h4>
<blockquote>
<p>if it's UB right now then I wouldn't tell people that it's valid. :)</p>
</blockquote>
<p>Well, rust doesn't really have a spec yet, so I generally assume everything is hand-wavy unless it is explicitly called out. As for the overflow thing, you are right, I misremembered that aspect. (But I think overflowing pointers is a relatively rare and unimportant phenomenon, so I don't mind any particular solution to it.)</p>



<a name="232644870"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232644870" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232644870">(Mar 31 2021 at 18:50)</a>:</h4>
<p>so to summarize, we have 4 possible sets of rules for <code>addr_of!((*ptr).field)</code>:</p>
<ol>
<li>the current official rules: <code>ptr</code> must be aligned and the offset must be inbounds (like with the <code>offset</code> Rust method)</li>
<li>the currently <em>implemented</em> rules, i.e. what we tell LLVM: the offset must be inbounds (but <code>ptr</code> might be misaligned)</li>
<li>the version that I think has most thrust behind it: the offset must not overflow (but <code>ptr</code> might dangle or be misaligned)</li>
<li>the safe version: this is just overflowing addition and never UB</li>
</ol>



<a name="232645071"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645071" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645071">(Mar 31 2021 at 18:52)</a>:</h4>
<p>there is also "0. the pointer must be valid, aligned and dereferenceable", which I don't think we want but seems like what C expects</p>



<a name="232645140"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645140" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645140">(Mar 31 2021 at 18:52)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232644682">said</a>:</p>
<blockquote>
<blockquote>
<p>if it's UB right now then I wouldn't tell people that it's valid. :)</p>
</blockquote>
<p>Well, rust doesn't really have a spec yet, so I generally assume everything is hand-wavy unless it is explicitly called out. As for the overflow thing, you are right, I misremembered that aspect. (But I think overflowing pointers is a relatively rare and unimportant phenomenon, so I don't mind any particular solution to it.)</p>
</blockquote>
<p><a href="https://doc.rust-lang.org/reference/behavior-considered-undefined.html">https://doc.rust-lang.org/reference/behavior-considered-undefined.html</a> is pretty clear in this regard. and the reason it is clear that because we dont have a spec, we need wiggle-room to be able to write one. by telling people to do things that are currently UB, you restrict the design space for a possible spec -- you basically preempt a decision the lang team hasn't even made yet. there's a reason the decision hasn't been made yet: the tradeoffs are complicated. so let's take our time for these rules and not make it impossible to make certain decisions by telling people to do things that we might end up making UB.</p>



<a name="232645180"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645180" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645180">(Mar 31 2021 at 18:53)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232645071">said</a>:</p>
<blockquote>
<p>there is also "0. the pointer must be valid, aligned and dereferenceable", which I don't think we want but seems like what C expects</p>
</blockquote>
<p>what does "valid" mean? I think C does 1 or 2</p>



<a name="232645206"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645206" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645206">(Mar 31 2021 at 18:53)</a>:</h4>
<p>pointing to a live allocation</p>



<a name="232645218"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645218" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645218">(Mar 31 2021 at 18:53)</a>:</h4>
<p>that's dereferencable</p>



<a name="232645227"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645227" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645227">(Mar 31 2021 at 18:53)</a>:</h4>
<p>so its part of 1</p>



<a name="232645240"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645240" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645240">(Mar 31 2021 at 18:53)</a>:</h4>
<p>if the offset is inbounds then the ptr is clearly dereferencable</p>



<a name="232645261"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645261" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645261">(Mar 31 2021 at 18:54)</a>:</h4>
<p>ah, gotcha</p>



<a name="232645474"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645474" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645474">(Mar 31 2021 at 18:55)</a>:</h4>
<p>By the way, I read "dereferencing" as <code>place2value(*ptr)</code> (unlike connor), is this term defined anywhere? That's part of why I think we disagree on the reading of what has been decreed UB on that page</p>



<a name="232645549"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645549" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645549">(Mar 31 2021 at 18:55)</a>:</h4>
<p>Basically I think we should make 2 official because I see very little benefit from the extra UB that 1 has, and it still leaves us free to go with 3 or 4 later. But until it was actually made official I'd recommend against exploiting that. Even under 2, <code>&amp;raw const (*ptr::null::&lt;A&gt;()).field</code> (which the question was about) is UB.</p>



<a name="232645642"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645642" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645642">(Mar 31 2021 at 18:56)</a>:</h4>
<p>If <code>*ptr</code> itself (the place) is already UB, then I don't see how <code>addr_of!((*ptr).field)</code> can avoid being UB as well</p>



<a name="232645647"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645647" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645647">(Mar 31 2021 at 18:56)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232645474">said</a>:</p>
<blockquote>
<p>By the way, I read "dereferencing" as <code>place2value(*ptr)</code> (unlike connor), is this term defined anywhere? That's part of why I think we disagree on the reading of what has been decreed UB on that page</p>
</blockquote>
<p>the term is awfully ambiguous, I agree. :/ that's why I wrote in the reference that it specifically refers to the <code>*</code> operator</p>



<a name="232645674"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645674" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645674">(Mar 31 2021 at 18:56)</a>:</h4>
<p>That's still ambiguous though</p>



<a name="232645684"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645684" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645684">(Mar 31 2021 at 18:56)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232645642">said</a>:</p>
<blockquote>
<p>If <code>*ptr</code> itself (the place) is already UB, then I don't see how <code>addr_of!((*ptr).field)</code> can avoid being UB as well</p>
</blockquote>
<p>indeed, to move to 2 we have to change the rules</p>



<a name="232645707"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645707" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645707">(Mar 31 2021 at 18:56)</a>:</h4>
<p>because <code>place2value</code> has no surface syntax</p>



<a name="232645764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645764">(Mar 31 2021 at 18:57)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232645674">said</a>:</p>
<blockquote>
<p>That's still ambiguous though</p>
</blockquote>
<p>I don't think so. when I talk about addition it would be unreasonable to assume I meant <code>(a+b)*c</code>. So likewise, when I talk about <code>*</code>, why would you assume I talk about <code>*</code> <em>followed by another operation</em>?</p>



<a name="232645769"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645769" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645769">(Mar 31 2021 at 18:57)</a>:</h4>
<p>so reasonable people will disagree on whether <code>*ptr</code> means the place or the value</p>



<a name="232645788"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645788" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645788">(Mar 31 2021 at 18:57)</a>:</h4>
<p>because it means both</p>



<a name="232645801"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645801" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645801">(Mar 31 2021 at 18:57)</a>:</h4>
<p>hm</p>



<a name="232645941"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232645941" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232645941">(Mar 31 2021 at 18:58)</a>:</h4>
<p>okay I will try to clarify this</p>



<a name="232646013"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232646013" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232646013">(Mar 31 2021 at 18:59)</a>:</h4>
<p>If <code>place2value</code> was an actual thing people wrote then I agree it would be a lot less ambiguous, but you have to lead with that and explain it, because I think a lot of people don't understand what lvalues or places are</p>



<a name="232646288"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232646288" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232646288">(Mar 31 2021 at 19:00)</a>:</h4>
<p>I propose to change the wording to something like</p>
<blockquote>
<p>Dereferencing (i.e., the <code>*expr</code> <em>place</em> expression) a dangling or unaligned raw pointer.</p>
</blockquote>
<p>would that help?</p>



<a name="232646409"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232646409" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232646409">(Mar 31 2021 at 19:01)</a>:</h4>
<p>yes we certainly have to properly explain place2value at some point; that's what's blocking me from proposing the move to (2)</p>



<a name="232646458"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232646458" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232646458">(Mar 31 2021 at 19:01)</a>:</h4>
<p>but I don't know how much work that would be and I currently dont have the time to figure that out^^</p>



<a name="232646487"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232646487" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232646487">(Mar 31 2021 at 19:01)</a>:</h4>
<p>Yes that would be better, although I would rather that not be UB :/</p>



<a name="232646505"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232646505" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232646505">(Mar 31 2021 at 19:01)</a>:</h4>
<p>but that's just me</p>



<a name="232646929"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232646929" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232646929">(Mar 31 2021 at 19:04)</a>:</h4>
<p>Is it legal (as a validity property) to have a dangling reference? Because I think the compiler can insert <code>&amp;*foo_ref</code> reborrows where the user wrote <code>foo_ref</code>, and the latter can be UB if <code>foo_ref</code> is dangling if the place <code>*foo_ref</code> is already UB</p>



<a name="232646970"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232646970" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232646970">(Mar 31 2021 at 19:04)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232646487">said</a>:</p>
<blockquote>
<p>Yes that would be better, although I would rather that not be UB :/</p>
</blockquote>
<p>sure, same here. but that's more than an editorial change. ;)</p>



<a name="232647057"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232647057" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232647057">(Mar 31 2021 at 19:05)</a>:</h4>
<blockquote>
<p>Is it legal (as a validity property) to have a dangling reference?</p>
</blockquote>
<p>no:</p>
<blockquote>
<p>The following values are invalid (at their respective type): <br>
[...]<br>
A reference or Box&lt;T&gt; that is dangling, unaligned, or points to an invalid value.</p>
</blockquote>



<a name="232647119"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232647119" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232647119">(Mar 31 2021 at 19:05)</a>:</h4>
<p>I want to change this to just</p>
<blockquote>
<p>A reference or Box&lt;T&gt; that is dangling, unaligned, or points to an uninhabited type (i.e. a type with no valid value inhabiting it)</p>
</blockquote>
<p>but that's a whole separate discussion ;)</p>



<a name="232647287"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232647287" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232647287">(Mar 31 2021 at 19:06)</a>:</h4>
<p>I guess you can't do the same with pointers unless you use <code>&amp;raw *foo_ptr</code> or <code>addr_of!(*foo_ptr)</code></p>



<a name="232736764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232736764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232736764">(Apr 01 2021 at 10:45)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232646487">said</a>:</p>
<blockquote>
<p>Yes that would be better, although I would rather that not be UB :/</p>
</blockquote>
<p>Yeah, I'm still confused on what exactly is and isn't UB here, and if we can somehow make <code>&amp;raw (*null::&lt;A&gt;()).field</code> safe then the compiler will help me know i'm not doing anything UB there.</p>
<p>an example of where I'm confused is on a more complex operation like <code>&amp;raw (*(*ptr).field).inner_field</code> do both dereferences need to follow rule 1 currently? or if <code>field</code> points to uninit data it is UB? (a value read IIUC).<br>
or maybe it should be <code>&amp;raw (*(&amp;raw (*ptr).field)).inner_field</code>?</p>



<a name="232738966"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232738966" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232738966">(Apr 01 2021 at 11:04)</a>:</h4>
<p>Irrespective of whether it is UB, it's not even really possible to ascribe a semantic meaning to <code>&amp;raw (*(*ptr).field).inner_field</code> other than "a garbage pointer possibly following an access to possibly read protected memory" if <code>ptr</code> points to deallocated or otherwise invalid memory</p>



<a name="232739204"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232739204" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232739204">(Apr 01 2021 at 11:07)</a>:</h4>
<p>Which is to say, this basically has to be UB</p>



<a name="232739374"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232739374" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232739374">(Apr 01 2021 at 11:08)</a>:</h4>
<p>In the case of <code>&amp;raw (*ptr).field</code>, there is at least a reasonable candidate for what it could mean when <code>ptr</code> is not valid, so we have options here</p>



<a name="232921471"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921471" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921471">(Apr 02 2021 at 16:44)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232647287">said</a>:</p>
<blockquote>
<p>I guess you can't do the same with pointers unless you use <code>&amp;raw *foo_ptr</code> or <code>addr_of!(*foo_ptr)</code></p>
</blockquote>
<p>can't do what with pointers?</p>



<a name="232921516"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921516" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921516">(Apr 02 2021 at 16:45)</a>:</h4>
<p><span class="user-mention silent" data-user-id="249222">Elichai Turkel</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232736764">said</a>:</p>
<blockquote>
<p>Yeah, I'm still confused on what exactly is and isn't UB here, and if we can somehow make <code>&amp;raw (*null::&lt;A&gt;()).field</code> safe then the compiler will help me know i'm not doing anything UB there.</p>
</blockquote>
<p>currently <code>&amp;raw (*null::&lt;A&gt;()).field</code> is always UB</p>



<a name="232921520"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921520" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921520">(Apr 02 2021 at 16:45)</a>:</h4>
<p>automatic reborrowing is not a thing that happens for pointers</p>



<a name="232921560"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921560" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921560">(Apr 02 2021 at 16:45)</a>:</h4>
<p>but I would really like <code>&amp;raw *foo_ptr</code> to be an identity function on pointers</p>



<a name="232921584"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921584" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921584">(Apr 02 2021 at 16:45)</a>:</h4>
<p>the confusion arises because in this discussion we are mixing "advice to a users trying to understand and follow the current Rust rules" and "arguments for how and why the Rust rules could or should be changed in the future"</p>



<a name="232921681"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921681" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921681">(Apr 02 2021 at 16:46)</a>:</h4>
<p><span class="user-mention" data-user-id="249222">@Elichai Turkel</span> if you want to write UB-free code, ignore all the discussion about hypothetical future changes to what is UB, and focus on</p>
<blockquote>
<p>Dereferencing (i.e., the <code>*expr</code> place expression) a dangling or unaligned raw pointer is UB.</p>
</blockquote>



<a name="232921726"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921726" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921726">(Apr 02 2021 at 16:46)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232921560">said</a>:</p>
<blockquote>
<p>but I would really like <code>&amp;raw *foo_ptr</code> to be an identity function on pointers</p>
</blockquote>
<p>in particular, a <em>total</em> identity function, not a partial one?</p>



<a name="232921753"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921753" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921753">(Apr 02 2021 at 16:47)</a>:</h4>
<p>yes, i.e. it does not assert validity of <code>foo_ptr</code></p>



<a name="232921781"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921781" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921781">(Apr 02 2021 at 16:47)</a>:</h4>
<p>yes</p>



<a name="232921804"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921804" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921804">(Apr 02 2021 at 16:47)</a>:</h4>
<p>that seems like a linux-kernel-bug style footgun</p>



<a name="232921841"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921841" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921841">(Apr 02 2021 at 16:47)</a>:</h4>
<p>I agree that's a nice property to have; but e.g. <span class="user-mention" data-user-id="294290">@NeoRaider</span> has expressed the exact opposite preference</p>



<a name="232921923"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921923" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921923">(Apr 02 2021 at 16:48)</a>:</h4>
<p>So clearly more discussion needs to be had before we can tell people to write such code :)</p>



<a name="232921952"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232921952" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232921952">(Apr 02 2021 at 16:48)</a>:</h4>
<p>true, true</p>



<a name="232959465"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232959465" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232959465">(Apr 02 2021 at 22:30)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232921681">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="249222">Elichai Turkel</span> if you want to write UB-free code, ignore all the discussion about hypothetical future changes to what is UB, and focus on</p>
<blockquote>
<p>Dereferencing (i.e., the <code>*expr</code> place expression) a dangling or unaligned raw pointer is UB.</p>
</blockquote>
</blockquote>
<p>So the only difference(in the dereference, not the reborrowing) is that the dereference doesn't require the data to be initialized?</p>



<a name="232959570"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232959570" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232959570">(Apr 02 2021 at 22:32)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232738966">said</a>:</p>
<blockquote>
<p>Irrespective of whether it is UB, it's not even really possible to ascribe a semantic meaning to <code>&amp;raw (*(*ptr).field).inner_field</code> other than "a garbage pointer possibly following an access to possibly read protected memory" if <code>ptr</code> points to deallocated or otherwise invalid memory</p>
</blockquote>
<p>Couldn't it be theoretically translated to <code>ptr as usize + offset_of!(OuterType.field) + offset_of!(InnerType.field)</code>? (that's weaker semantics than C afaik)</p>



<a name="232959603"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232959603" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232959603">(Apr 02 2021 at 22:32)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232921584">said</a>:</p>
<blockquote>
<p>the confusion arises because in this discussion we are mixing "advice to a users trying to understand and follow the current Rust rules" and "arguments for how and why the Rust rules could or should be changed in the future"</p>
</blockquote>
<p>yeah that's on me, I'm trying to both understand how to avoid UB right now, and also figure out if we can make it easier and less restrictive</p>



<a name="232961725"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232961725" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232961725">(Apr 02 2021 at 23:02)</a>:</h4>
<p><span class="user-mention silent" data-user-id="249222">Elichai Turkel</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232959570">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232738966">said</a>:</p>
<blockquote>
<p>Irrespective of whether it is UB, it's not even really possible to ascribe a semantic meaning to <code>&amp;raw (*(*ptr).field).inner_field</code> other than "a garbage pointer possibly following an access to possibly read protected memory" if <code>ptr</code> points to deallocated or otherwise invalid memory</p>
</blockquote>
<p>Couldn't it be theoretically translated to <code>ptr as usize + offset_of!(OuterType.field) + offset_of!(InnerType.field)</code>? (that's weaker semantics than C afaik)</p>
</blockquote>
<p>That would be <code>&amp;raw (*ptr).field.inner_field</code>, and I agree that this should be defined (although as Ralf has pointed out, it isn't according to the current wording in the reference)</p>



<a name="232991192"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232991192" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232991192">(Apr 03 2021 at 08:26)</a>:</h4>
<p><span class="user-mention silent" data-user-id="249222">Elichai Turkel</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232959465">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232921681">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="249222">Elichai Turkel</span> if you want to write UB-free code, ignore all the discussion about hypothetical future changes to what is UB, and focus on</p>
<blockquote>
<p>Dereferencing (i.e., the <code>*expr</code> place expression) a dangling or unaligned raw pointer is UB.</p>
</blockquote>
</blockquote>
<p>So the only difference(in the dereference, not the reborrowing) is that the dereference doesn't require the data to be initialized?</p>
</blockquote>
<p>yes, basically</p>



<a name="232999480"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232999480" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232999480">(Apr 03 2021 at 11:19)</a>:</h4>
<p>Wait, does <code>&amp;raw (*outer).inner.field</code> create an intermediate reference even when no <code>Deref</code> shenanigans are involved?</p>



<a name="232999562"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/232999562" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#232999562">(Apr 03 2021 at 11:20)</a>:</h4>
<p>I'd expect that to be equivalent to</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="o">&amp;</span><span class="n">raw</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="p">(</span><span class="o">&amp;</span><span class="n">raw</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="n">outer</span><span class="p">).</span><span class="n">inner</span><span class="p">)).</span><span class="n">field</span><span class="w"></span>
</code></pre></div>



<a name="233000094"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233000094" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233000094">(Apr 03 2021 at 11:30)</a>:</h4>
<p><span class="user-mention silent" data-user-id="232018">Daniel Henry-Mantilla</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232999480">said</a>:</p>
<blockquote>
<p>Wait, does <code>&amp;raw (*outer).inner.field</code> create an intermediate reference even when no <code>Deref</code> shenanigans are involved?</p>
</blockquote>
<p>it does not</p>



<a name="233000105"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233000105" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233000105">(Apr 03 2021 at 11:31)</a>:</h4>
<p><span class="user-mention silent" data-user-id="232018">Daniel Henry-Mantilla</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232999562">said</a>:</p>
<blockquote>
<p>I'd expect that to be equivalent to</p>
<p><div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="o">&amp;</span><span class="n">raw</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="p">(</span><span class="o">&amp;</span><span class="n">raw</span><span class="w"> </span><span class="p">(</span><span class="o">*</span><span class="n">outer</span><span class="p">).</span><span class="n">inner</span><span class="p">)).</span><span class="n">field</span><span class="w"></span>
</code></pre></div><br>
</p>
</blockquote>
<p>wait... what are your types here? now there are nested pointers so I am confused.^^</p>



<a name="233000126"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233000126" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233000126">(Apr 03 2021 at 11:32)</a>:</h4>
<p>See <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232644870">here</a> for a summary of the previous discussion</p>



<a name="233002293"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233002293" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233002293">(Apr 03 2021 at 12:12)</a>:</h4>
<p>The types would be plain flat structural records (that's what I meant by lack of <code>Deref</code>, although I should have mentioned lack of references too)</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">struct</span> <span class="nc">Outer</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">inner</span>: <span class="nc">Inner</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="k">struct</span> <span class="nc">Inner</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">field</span>: <span class="nc">Field</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">storage</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">MaybeUninit</span>::<span class="o">&lt;</span><span class="n">Outer</span><span class="o">&gt;</span>::<span class="n">uninit</span><span class="p">();</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">outer</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="n">Outer</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">storage</span><span class="p">.</span><span class="n">as_ptr</span><span class="p">();</span><span class="w"></span>
</code></pre></div>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/233000094">said</a>:</p>
<blockquote>
<p>it does not</p>
</blockquote>
<p>Good, that's what I'd have expected, but I got confused because of:</p>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232961725">said</a>:</p>
<blockquote>
<p>(although as Ralf has pointed out, [<code>&amp;raw (*ptr).field.inner_field</code>] isn't [[well] defined] according to the current wording in the reference)</p>
</blockquote>



<a name="233002591"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233002591" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233002591">(Apr 03 2021 at 12:18)</a>:</h4>
<p><span class="user-mention" data-user-id="232018">@Daniel Henry-Mantilla</span> we were talking about two different situations above: one where there's a ptr to a struct containing a struct, and one where there's a ptr to a struct containing a <em>ptr to</em> a struct</p>



<a name="233002602"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233002602" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233002602">(Apr 03 2021 at 12:18)</a>:</h4>
<p>I think you mixed up responses from the two different discussions</p>



<a name="233002636"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233002636" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233002636">(Apr 03 2021 at 12:19)</a>:</h4>
<blockquote>
<p>Good, that's what I'd have expected, but I got confused because of:</p>
</blockquote>
<p>again, <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/raw.20ref.20semantics/near/232644870">see here</a>. there are situations where this is not well-defined.</p>



<a name="233002650"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233002650" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233002650">(Apr 03 2021 at 12:19)</a>:</h4>
<p>but sadly this thread is full of not-self-contained examples so just reading any part of it is extremely confusing^^</p>



<a name="233002873"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233002873" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233002873">(Apr 03 2021 at 12:23)</a>:</h4>
<p>Yes yes, I was mainly focusing on nested place access (but without extra indirection); as I mentioned, I wanted to make sure the equivalent held (actually, it may not hold if <code>field</code> is unaligned (packed struct) if we keep the alignment requirement <span aria-label="warning" class="emoji emoji-26a0" role="img" title="warning">:warning:</span>)</p>



<a name="233003187"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233003187" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233003187">(Apr 03 2021 at 12:28)</a>:</h4>
<p>Actually, this last point changes things.</p>
<p>EDIT: I follow this point on the appropriate thread; <a href="#narrow/stream/213817-t-lang/topic/Alignment.20and.20raw.20pointer.20deref/near/233003780">link to my comment with the code snippet</a></p>



<a name="233003312"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233003312" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233003312">(Apr 03 2021 at 12:31)</a>:</h4>
<p>That last UB is why I started <a href="#narrow/stream/213817-t-lang/topic/Alignment.20and.20raw.20pointer.20deref">this thread</a></p>



<a name="233003315"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233003315" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233003315">(Apr 03 2021 at 12:31)</a>:</h4>
<p>but currently it is indeed UB</p>



<a name="233003329"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233003329" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233003329">(Apr 03 2021 at 12:31)</a>:</h4>
<p>the first branch is indeed okay</p>



<a name="233003586"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233003586" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233003586">(Apr 03 2021 at 12:35)</a>:</h4>
<p>Yeah, I am mixing a bit these two threads since there is an overlap <span aria-label="sweat smile" class="emoji emoji-1f605" role="img" title="sweat smile">:sweat_smile:</span>. <del>I'll move my post there.</del> I can't  move cross-streams <span aria-label="disappointed" class="emoji emoji-1f61e" role="img" title="disappointed">:disappointed:</span>, so I have manually cut-and-pasted it.</p>



<a name="233003909"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw%20ref%20semantics/near/233003909" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/raw.20ref.20semantics.html#233003909">(Apr 03 2021 at 12:40)</a>:</h4>
<p>yeah the two theads were created without much coordination, mostly by coincidence^^</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>